Prompt Injection Can Steer Agents into Dangerous Tool Calls and Secret Access With No Containment Layer

Summary

Prompt injection has been the #1 OWASP LLM risk since 2022 and no reliable defense exists: filtering fails, 'ignore injected instructions' is just more text in the same channel, and adaptive attacks bypass all eight evaluated defenses at over 50% success. Researchers documented 22 ways to hide instructions in ordinary web pages — white text, tiny fonts, page code — telling agents to exfiltrate accessible data, ignore their instructions, or visit attacker sites, all invisibly to the user. When that agent also holds shell access, .env secrets, and MCP tool credentials, a visit to the wrong page becomes a live security incident. The research consensus is that the only real mitigation is moving control outside the model — deterministic policies that mediate what an agent's output is permitted to cause — yet developers today have nothing practical implementing that on their own machine. This is unsolved, high-anxiety, and high-value: teams cannot audit what an agent read five minutes ago, and there is no local checkpoint that notices an unusual secret read or outbound tool call and pauses it for approval.